GlobalProtect Portal Auth Bypass/Impersonation in PAN-OS
CVE-2024-8691 Published on September 11, 2024
PAN-OS: User Impersonation in GlobalProtect Portal
A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vulnerability are disconnected from GlobalProtect. Upon exploitation, PAN-OS logs indicate that the impersonated user authenticated to GlobalProtect, which hides the identity of the attacker.
Timeline
Initial publication
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2024-8691 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2024-8691
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-8691 are published in Palo Alto Networks PAN-OS:
Affected Versions
Palo Alto Networks PAN-OS:- Version 9.1.0 and below 9.1.17 is affected.
- Version 10.1.0 and below 10.1.11 is affected.
- Version 10.2.0 is unaffected.
- Version 11.0.0 is unaffected.
- Version 11.1.0 is unaffected.
- Version 11.2.0 is unaffected.
- Version All is unaffected.
- Version All is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.